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In the claims ; 



\ 




1. ( Cur rently\ amended) A method for real-time measurement 
of the performance ©f communications on a large area network 
between a selected server and a plurality of users, based upon 
actual user experience, including: 

(a) accessing a server log having records of actual user 
access to the selected qerver; 

(b) aggregating records from the server log into a 
plurality of aggregate sldts, each slot having at least one time 
bin which represents an interval of time , based on an 
aggregation method; 

(c) performing at least 6ne statistical analysis separately 
on [of] each time bin of each aggregate slot; and 

(d) outputting the results ©f such statistical analysis as 
an indication of actual server usage by users . 



2. (Original) The method of claim 1, further including 
filtering out selected records from fthe server log before the 
step of aggregating. 



3. (Original) The method of claim l\ further including 
generating an event notification if a selected statistical 
analysis value is abnormal. 
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4. (Original) The method of claim 1, further including 
selecting th^ aggregation method from a set of aggregation 
methods . 



5. (Original) The method of claim 1, wherein the 
aggregation method includes aggregation by log- file record 
column data value f©r each record from the server log. 




6. (Original) TheVnethod of claim 1, further including: 

(e) determining geographical or source information for each 
record; and 

(f ) selecting the aggregation method to aggregate records 
based on such geographical on source information. 

7> (Original) The method ok claim 6, wherein determining 
geographical or source information for each record includes: 

(g) defining a database comprising large area network 
address blocks having geographical or source information; 

(h) comparing an address field ±\ each record to the 
address blocks in the database; and 

(i) associating with each record thh geographical or source 
information from an address block matching^ the address field of 
the record. 
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S.Voriginal) The method of claim 7, wherein comparing an 
address meld in each record to the address blocks in the 
database includes: 

(j) deraning an array of binary trees for the address 
blocks in the\ database, each address block within a binary tree 
within an array element being masked by a corresponding unique 
subnet mask vali\e; 

(k) masking \each address field in each record by a unique 
subnet value corresponding to a selected array element; 

(1) comparing each masked address field to an address field 
of the address block^ within the binary tree of the selected 
array element; 

(m) outputting selected fields of any matching address 
block; and 

(n) otherwise, continuing the step of comparing with a next 
selected array element untiV: a match is found or all array 
elements have been compared J 



9. (Original) The method dfi claim 1, further including: 
(o) determining exit routirig paths from each selected 
server based on the records from Vhe server log; 

(p) determining a best performing exit route based on the 
statistical analysis of records from the server log; 
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q) biasing incoming and outgoing communications with 
respecu to each server to use the determined best performing 
exit route. 




10 . (withdrawn) 

11. (Currently amended) A system for real-time measurement 
of the performance of communications on a large area network 
between a selected server and a plurality of users , based upon 
actual user experience, including: 

(w) a server log^ having records of actual user access to 
the selected server ; 

(x) means for accessing and aggregating records from the 
server log into a plurality of aggregate slots , each having at 
least one time bin which represents an interval of time , based 
on an aggregation method; 

(y) means for performing \at least one statistical analysis 
of each time bin of each aggregate slot; and 

(z) means for outputting thd results of such statistical 
analysis as an indication of actual server usage by users. 

12. (Currently amendment) The ^stem of claim 11, further 
including means for filtering out selected records from the 
server log before the step of aggregating, 

8 
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/ 



means for generating an event notification if a selected 
statistical analysis value is abnormal. 



14. (Original) The system of claim 11, further including 
means for selecting the aggregation method from a set of 
aggregation methods! 




15. (Original) Th^ system of claim 11, wherein the 
aggregation method inclines aggregation by log- file record 
column data value for each record from the server log. 



16. (Original) The systWn of claim 11, further comprising: 
(aa) means for determining geographical or source 

information for each record; ar 

(bb) means for selecting thV aggregation method to 

aggregate records based on such geographical or source 

information. 



17. (Original) The system of clkim 16, wherein the means 
for determining geographical or source \informat ion for each 
record includes: 
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(cc) a database comprising large area network address 
blocks having geographical or source information; 

(dd) a comparison function for comparing an address field 
in each recordVto the address blocks in the database; and 

(ee) an associating function for associating with each 
record the geographical or source information from an address 
block matching the address field of the record. 



16. (Original) Trie system of claim 17, wherein the 
comparison function includes: 

(ff) an array of binary trees from the address blocks in 
the database, each address ©lock within a binary tree within an 
array element being masked by^a corresponding unique subnet mask 
value ; 

(gg) means for masking eacA address field in each record by 
a unique subnet value corresponding to a selected array element; 

(hh) means for comparing each\masked address field to an 
address field of the address bocks *^.thin the binary tree of the 
■ selected array element; 

(ii) means for output ting selectee^ fields of any matching 
address block ;and 

(jj) means for otherwise continuing Vhe step of comparing 
with a next selected array element until mJjtch is found or all 
array elements have been compared. 



10 

Received from < 858 678 5099 > at 3126103 7:28:51 PM [Eastern Standard Time] 



03/26/2003 18:25 FAX 858 678 5099 



FISH & RICHARDSON 



1012/020 



<7 




Attorney's Docket No. ; 10559/09600/P7315/Intel Corporation 



19 \ (Original) The system of claim 11, further including: 
(kk) \means for determining exit routing paths for each 
selected server based on the records from the server log; 

(11) meVns for determining a best performing exit route 
based on the statistical analysis of records from the server 
log; 

(mm) means ior biasing incoming and outgoing communications 
with respect to ea\jh server to use the determined best 
performing exit rout 
20. (Withdrawn) 



21. (Currently amended) A computer program, stored on a 
computer- readable medium, for real-time measurement of the 
performance of communications on a large area network between a 
selected server and a plurality of users, based upon actual user 
experience, the computer prograr^ comprising instructions for 
causing a coputer system to: 

(ss) access a server log having records of actual user 
access to the selected server; 

(tt) aggregate records from the ^server log into a plurality 
of aggregate slots, each having at lea^t one time bin, based on 
an aggregation method ; 
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uu) perform at least one statistical analysis of each time 
bin , representing a time interval, of each aggregate slot; and 

(w\ output the results of such statistical analysis as an 
indication of actual server usage by users. 




22. (Original) The computer program of claim 21, further 
including instructions for causing the computer system to filter 
out selected records from the server log before the step of 
aggregating. 

23. (Original) Ttife computer program of claim 21, further 
including instructions fcjr causing the computer system to 
generate an event notification if a selected statistical 
analysis value is abnormal, 



24. (Original) The computer program of claim 21, further 
including instructions for causing the computer system to select 
the aggregation method from a set of aggregation methods. 



25. (Original) The computer program of claim 21 , wherein 
the aggregation method includes aggregation by log- file record 
column data value for each record from thfe server log. 
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6. (Original) The computer program of claim 21, further 
including instructions for causing the computer system to: 

(wwO determine geographical or source information for each 
record ; arid 

(xx) select the aggregation method to aggregate records 
based on sucl\ geographical or source information. 




27. (Original) The computer program of claim 26, wherein 
the instructions for causing the computer systems to determine 
geographical or source information for each record further 
include instructions for causing the computer system to: 

(yy) define a database comprising large area network 
address blocks having geographical or source information ; 

(zz) compare an address field in each record to the address 
blocks in the database; and* 

(aaa) associate with eacli record the geographical or source 
information from an address blqck matching the address field of 
the record. 



28. (Original) The computer program of claim 27, wherein 
the instructions for causing the computer system to compare an 
address field in each record to the address blocks in the 
database include instructions for causing the computer system 
to: 
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(bb&) define an array of binary trees for the address 
blocks in database, each address block within a binary tree 

within an aVray element being masked by a corresponding unique 
subnet mask ^lue; 

(ccc) make each address field in each record by a unique 
subnet value corresponding to a selected array element; 

(ddd) compar^ each masked address field to an address field 
of the address blocks within the binary tree of the selected 
array element ; 

(eee) output selected fields of any matching address block; 

and 

(fff) otherwise, coritinue the step of comparing with a next 
selected array element unt\l a match is found or all array 
elements have been compared .\ 



29. (Original) The compute program of claim 21, further 
including instructions for causing the computer system to; 

(ggg) determine exit routing \>aths from each selected 
server based on the records from the server log; 

(hhh) determine a best performing exit route based on the 
statistical analysis of records from the server log; 

(iii) bias incoming and outgoing communications with 
respect to each server to use the determined best performing 
exit route. 
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' /30. 



(Withdrawn) 
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